[Akanksha Jain (jainakanksha-msft)]

Summary

Carry forward #2876 onto a new branch based on main for release consideration, preserving the original author's attribution. Includes the source-authorization implementation, tests, and the separator-normalization fix from commit c6461a7.

Related issue: #2815. This is a partial fix: the separate Copy Blob From URL handler remains out of scope.

Changes

• Forward explicit bearer source authorization to the internal source reads for Put Blob From URL and Put Block From URL.
• Forward the same source credential when Put Blob From URL copies source tags.
• Restrict source credentials to the bearer scheme and normalize scheme casing and multiple separator spaces without changing global authentication.
• Add positive and negative OAuth tests, including both copy operations, two/three separator spaces, copied content, and whitespace-only token rejection.
• Update the Upcoming Release changelog entry.

Validation

• npm run build and npm run lint: passed.
• git diff --check: passed.
• Compiled OAuth and Block Blob API suites: 118 passing.
• In-memory OAuth suite: 27 passing.
• Negative control with the original forwarding expression: both new spacing regressions fail as expected.

Existing installed dependencies were reused. Local HTTPS tests used the repository-standard TLS test override. SQL-backed execution and live Azure checks were not repeated for this branch; test tags do not establish SQL coverage.

Reviewer notes

• Reuses Azurite's existing --oauth basic behavior; does not add token-signature or RBAC enforcement.
• Mixed SAS/bearer behavior and unsupported-scheme error parity remain compatibility follow-ups; this PR preserves the existing proposed behavior rather than globally changing authentication order.
• The independent branch does not bypass contributor CLA requirements. Original authorship is retained; any outstanding agreement requirements still need contributor/maintainer resolution.
• Forward x-ms-copy-source-authorization when reading a copy source (issue #2815) #2876 is linked for provenance and prior review discussion; it has not been closed or merged by this operation.

Checklist

• Targets main (Azurite V3).
• Tests cover the changed behavior.
• User-visible change documented under Upcoming Release.

[Copilot]

🟢 Approval recommended

No active review issues are identified for the source bearer-authorization changes.

No open issues 🎉

What changed in this PR

Adds bearer authorization for private URL copy sources in Azurite’s Blob service, partially addressing #2815. The separate Copy Blob From URL handler remains out of scope.

Changes:

• Forwards source bearer credentials for Put Blob From URL, Put Block From URL, and copied source tags.
• Normalizes bearer scheme casing and repeated separator spaces while rejecting unsupported schemes.
• Adds OAuth regression coverage and documents the user-visible behavior.

The PR reports successful build, lint, and targeted tests. SQL-backed execution and live Azure compatibility checks were not repeated.

File	Description
tests/​blob/​oauth.test.ts	Adds source authorization, tag copying, normalization, and credential rejection tests.
src/​blob/​handlers/​BlockBlobHandler.ts	Validates and forwards bearer source credentials to content and tag reads.
ChangeLog.md	Documents source authorization support under Upcoming Release.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the bearer source-authorization change.

No open issues 🎉

_{Review effort: Balanced}